Re: -sP showing all hosts in request as up

[David Fifield <david () bamsoftware com>]

On Wed, Aug 26, 2009 at 09:58:30AM -0500, Terry wrote:
> I am confused about some output I am seeing.  Why would nmap -sP
> subnet/24 return every IP in the block as up when they clearly arent?
> This happens even on the local subnet.  I have a feeling the answer is
> very easy I am just stuck.

This can happen if a network device is faking ARP replies from
nonexistent hosts. Try scanning with the --send-ip option. This thread
has some more information.

http://seclists.org/nmap-dev/2009/q3/0338.html

David Fifield

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org